Live › vulnerability › CVE-2026-121628
Bagisto, an open-source Laravel e-commerce platform, has a race condition in its cart rule handling where concurrent checkout requests bypass the times_used check. An attacker can apply a single-use coupon multiple times and get repeated discounts.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 18:22 UTC. All times on this page are UTC.
Stores running Bagisto versions before 2.3.16 or 2.4.x before 2.4.1 that offer single-use coupons are exposed, since the flaw is in the onepage checkout order endpoint. Stores on managed hosting that does not expose the Bagisto code path, or with no single-use cart rules, have lower exposure. Sources do not say whether authentication is required to reach the endpoint.
No product ranges from the sources yet.
bagisto/bagisto2.3.16 for the 2.3.x line and 2.4.1 for the 2.4.x line2.3.16 or later2.4.1 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Bagisto before 2.3.16 and 2.4.x before 2.4.1 contains a race condition vulnerability in manageCartRule() that allows attackers to redeem single-use coupons multiple times. Attackers can submit concurrent order requests to the onepage orders checkout endpoint, bypassing unlocked times_used checks to apply discounts repeatedly.
This page as .md · .json · in your agent: get_signal("CVE-2026-121628")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.